CSSLP Practice Questions: Secure Software Supply Chain Domain

Correct Answer: B

Explanation: Regular vulnerability scanning of container images and enforcing the use of signed images are effective practices for ensuring the security of containerized applications. These measures help identify and mitigate vulnerabilities and ensure the integrity of the container images used in the deployment.

Correct Answer: B

Explanation: Implementing a process for continuous monitoring of software supply chain risks aligns with NIST SSDF guidelines, which emphasize ongoing risk assessment and management. Option A may not offer the transparency and flexibility required. Option C is reactive and does not address the proactive risk management aspect. Option D, while important for overall security awareness, does not specifically address supply chain security.

Correct Answer: C

Explanation: The first step in addressing security concerns with open source components is to establish a policy that governs their use and management. This provides a framework for assessing and mitigating risks associated with open source software. A risk assessment (A) and SBOM implementation (B) are important but should follow policy establishment. Engaging a third-party vendor (D) can be part of the process but is not the initial step.

Correct Answer: C

Explanation: Establishing a software bill of materials (SBOM) is the best next step as it provides a comprehensive inventory of all components, including open-source ones. This enables the organization to track and manage vulnerabilities effectively. While conducting a risk assessment (A) and training developers (D) are important, they are more effective once you have a clear understanding of what components are in use. Implementing CI/CD pipelines (B) is more about automation and efficiency than directly addressing component security.

Correct Answer: C

Explanation: Establishing a governance framework for secure software development is the first step to ensure compliance and integrate security into the SDLC. It provides the structure and policies needed to guide secure practices. Option A is a later stage activity after deployment. Option B is important but comes after establishing governance. Option D is specific to vendors and not the initial step for SDLC integration.